mirror of
https://github.com/openai/codex.git
synced 2026-11-13 21:30:47 +00:00
cooper-oai
44f1b0e867
## Why Realtime connections bypassed runtime authentication and reused captured authentication headers for sideband handshakes. They need to honor the selected credential source and its transport policy across call creation, retries, and reconnects. ## What changed - Use runtime authentication for realtime WebSocket connections, WebRTC call creation, and sideband attachment when enabled for supported OpenAI destinations. - Resolve authentication on every WebSocket handshake, preserving credential ownership and request scope while generating fresh assertions. Reject authentication failures without falling back to bearer authentication. - Keep call creation and sideband attachment bound to the selected credentials and account network policy, including when inference uses a different provider. - Avoid runtime initialization for local marketplace and MCP operations, plugin commands that do not use the remote catalog, and model debugging with a configured catalog. ## Testing Add coverage for fresh handshake credentials on retries and reconnects, credential and account changes, runtime authentication modes, destination validation, and registration failures. GitOrigin-RevId: 57e53122912fa78a524427b0f51013f76f9f7681
74 lines
2.8 KiB
Rust
74 lines
2.8 KiB
Rust
mod amazon_bedrock;
|
|
mod auth;
|
|
mod bearer_auth_provider;
|
|
mod capabilities;
|
|
mod catalog_factory;
|
|
mod chatgpt_base_url;
|
|
mod client_auth;
|
|
mod combined_auth;
|
|
mod gateway_auth;
|
|
mod gateway_export;
|
|
mod gcp;
|
|
mod models_endpoint;
|
|
mod models_identity;
|
|
mod provider;
|
|
mod request_preparation;
|
|
mod request_setup;
|
|
mod runtime_auth;
|
|
mod shared_state;
|
|
pub mod test_support;
|
|
mod workspace_routing;
|
|
pub use workspace_routing::ACCOUNT_ROUTING_HEADER;
|
|
pub use workspace_routing::ResolvedResponsesProvider;
|
|
pub use workspace_routing::ResponsesConnectionKey;
|
|
pub use workspace_routing::WorkspaceRoutingContext;
|
|
|
|
pub use amazon_bedrock::is_amazon_bedrock_gov_cloud_region;
|
|
pub use amazon_bedrock::is_supported_amazon_bedrock_region;
|
|
pub use amazon_bedrock::resolve_amazon_bedrock_region;
|
|
pub use auth::AgentIdentitySessionFallback;
|
|
pub use auth::ProviderAuthContext;
|
|
pub use auth::ProviderAuthScope;
|
|
pub use auth::ResolvedProviderAuth;
|
|
pub use auth::auth_provider_for_request;
|
|
pub use auth::auth_provider_from_auth;
|
|
pub use auth::auth_provider_from_auth_manager;
|
|
pub use auth::unauthenticated_auth_provider;
|
|
pub use bearer_auth_provider::BearerAuthProvider;
|
|
pub use bearer_auth_provider::BearerAuthProvider as CoreAuthProvider;
|
|
pub use capabilities::ProviderCapabilities;
|
|
pub use catalog_factory::ModelCatalogFactory;
|
|
pub use chatgpt_base_url::ChatgptBaseUrl;
|
|
pub use chatgpt_base_url::DEFAULT_CHATGPT_BASE_URL;
|
|
pub use client_auth::ClientAuth;
|
|
pub use codex_model_provider_info::AMAZON_BEDROCK_PROVIDER_ID;
|
|
pub use codex_model_provider_info::AMAZON_BEDROCK_RUNTIME_PROVIDER_ID;
|
|
pub use codex_model_provider_info::CHATGPT_CODEX_BASE_URL;
|
|
pub use codex_model_provider_info::GCP_PROVIDER_ID;
|
|
pub use codex_model_provider_info::RemoteCompactionSupport;
|
|
pub use codex_protocol::account::ProviderAccount;
|
|
pub use gateway_auth::GatewayAuthManager;
|
|
pub use provider::ModelProvider;
|
|
pub use provider::ModelProviderFuture;
|
|
pub use provider::ProviderAccountError;
|
|
pub use provider::ProviderAccountResult;
|
|
pub use provider::ProviderAccountState;
|
|
pub use provider::ProviderAuthRecoveryMessages;
|
|
pub use provider::ProviderUnauthorizedRecovery;
|
|
pub use provider::SharedModelProvider;
|
|
pub use provider::create_model_provider;
|
|
pub use provider::provider_uses_first_party_auth_path;
|
|
pub use provider::resolve_api_provider;
|
|
|
|
pub use request_preparation::prepare_provider_request;
|
|
pub use request_setup::ResolvedProviderRequest;
|
|
pub use request_setup::request_auth_owner;
|
|
pub use request_setup::resolve_request;
|
|
pub use runtime_auth::runtime_auth_for_url;
|
|
pub use runtime_auth::select_runtime_auth_for;
|
|
pub(crate) use runtime_auth::select_runtime_auth_for_source;
|
|
pub use runtime_auth::select_runtime_provider;
|
|
pub use runtime_auth::validate_runtime_destination;
|
|
pub use runtime_auth::validate_runtime_environment;
|
|
pub use runtime_auth::validate_runtime_selectors;
|